CCNA Network Services and Security Practice Test 25 — 15 Questions

Question 1

An engineer applies this command on an access interface connected to a user PC: switchport port-security violation restrict. What happens if a second unauthorized MAC address appears on the port?

Accepted Answer

Frames from the unauthorized MAC are dropped and the violation is counted while the port stays up.. With restrict mode, the switch drops frames from the violating MAC, increments the violation counter, and can generate notifications. Unlike shutdown mode, the interface stays up. Unlike protect mode, the switch records the violation.

Answer

The port immediately goes err-disabled.

Answer

The switch forwards the traffic but logs a warning.

Answer

The port transitions to listening and learning states.

Question 2

Match each HTTP method to its common REST API action.

Accepted Answer

GET - Retrieve data. GET retrieves data; POST creates; PUT replaces; PATCH partially updates; DELETE removes; OPTIONS queries available methods.

Answer

GET - Create data

Answer

POST - Retrieve data

Answer

PUT - Partially update data

Question 3

R1 receives an OSPF route to 10.55.0.0/16 and already has a static route to 10.55.10.0/24. Which route will be used for traffic sent to 10.55.10.25?

Accepted Answer

The static /24 route, because it is the longest-prefix match.. The static /24 route is more specific than the OSPF /16 route, so longest-prefix match wins. Administrative distance is only compared among routes to the same prefix length.

Answer

The OSPF /16 route, because dynamic routes override static routes learned later.

Answer

Both routes equally, because they point to the same major network.

Answer

Neither route, because overlapping routes are invalid.

Question 4

Which STP role identifies the port on a non-root switch that has the best path back to the root bridge?

Accepted Answer

Root port. The root port is the single port on a non-root switch that provides the lowest-cost path toward the root bridge. Designated ports forward away from the root for a segment, and alternate ports are backup paths.

Answer

Designated port

Answer

Alternate port

Answer

Disabled port

Question 5

Users on a new access switch can reach devices in their own VLAN but cannot reach the default gateway on the distribution switch. Based on the exhibit, what is the most likely cause?

Accepted Answer

VLAN 30 is missing from the allowed VLAN list on the trunk.. The trunk allows only VLANs 10 and 20, so VLAN 30 traffic never crosses the uplink. Local switching inside VLAN 30 on the access switch can still work, which is why same-VLAN communication succeeds. Adding VLAN 30 to the allowed list is the direct fix.

Answer

The user ports should be configured as trunks.

Answer

The SVI for VLAN 30 must be shutdown for inter-VLAN routing to work.

Answer

The trunk native VLAN must be changed to VLAN 30.

Question 6

PCs in VLAN 40 are not receiving addresses from the centralized DHCP server at 172.16.1.10. What should be configured on the VLAN 40 default gateway interface?

Accepted Answer

ip helper-address 172.16.1.10. When DHCP clients and the DHCP server are on different subnets, the router interface serving the client subnet must relay broadcasts to the server with the ip helper-address command.

Answer

ip dhcp excluded-address 10.40.40.1 10.40.40.10

Answer

service dhcp

Answer

ip default-gateway 172.16.1.10

Question 7

An administrator wants an access-layer interface to shut down immediately if another switch is connected accidentally. Which feature best meets that requirement?

Accepted Answer

BPDU Guard. BPDU Guard is designed for edge ports. If the port receives a BPDU, the switch treats that as a sign that another switch has been connected and places the interface into an err-disabled state to protect the spanning-tree topology.

Answer

Root Guard

Answer

PortFast

Answer

Loop Guard

Question 8

An engineer configures NAT overload on a router for inside users. Which resource is primarily used to let many internal hosts share one public IPv4 address?

Accepted Answer

TCP and UDP port numbers. PAT distinguishes sessions by using Layer 4 port numbers. That is what allows many inside devices to use the same outside IP address at the same time without conflicting with each other.

Answer

IPv6 extension headers

Answer

Different source MAC addresses on the WAN

Answer

Separate routing tables per client

Question 9

A network team wants routers and switches to have consistent timestamps in logs so event correlation is accurate during an outage. Which service should they verify first?

Accepted Answer

NTP. Consistent timestamps depend on synchronized clocks. NTP is the service used to keep network devices aligned to the same time reference, which makes syslog analysis and troubleshooting much more reliable.

Answer

DNS

Answer

SNMP

Answer

CDP

Question 10

Exhibit: A standard ACL meant to block host 10.10.10.50 from reaching any remote network was applied inbound on the branch router's LAN interface, but users report that all local traffic from that host is now blocked. What is the better placement?

Accepted Answer

Move it outbound on the WAN-facing interface closer to the destination. A standard ACL matches only the source address. If it is placed near the source, it can block that host from reaching destinations you did not intend to affect. Standard ACLs are best placed close to the destination.

Answer

Leave it inbound on the LAN because standard ACLs belong near the source

Answer

Convert it to a VTY access-class

Answer

Apply it inbound on all switch access ports

Question 11

Exhibit: A client can ping 8.8.8.8 but cannot browse to www.example.com. Which service is most likely failing?

Accepted Answer

DNS. The client has IP connectivity because it can reach 8.8.8.8 directly. The problem appears only when using a hostname, which points to a DNS resolution issue rather than a routing issue.

Answer

NTP

Answer

DHCP snooping

Answer

HSRP

Question 12

An administrator wants to permit HTTP and HTTPS from 10.1.10.0/24 to a web server at 198.51.100.20 and deny everything else from that subnet. Which ACL type is required?

Accepted Answer

Extended ACL. A standard ACL can match only the source address. To permit specific protocols and ports such as TCP 80 and 443 to a specific destination, the administrator must use an extended ACL.

Answer

Named standard ACL

Answer

Prefix list

Answer

MAC access-list

Question 13

Exhibit: Users report no internet access after PAT was configured. The inside and outside interfaces are marked correctly. Which missing configuration is the most likely cause?

Accepted Answer

No ACL and nat overload statement identifying inside source addresses. PAT needs both the inside and outside interface roles and a NAT statement referencing an ACL that identifies the inside local addresses. Without the ACL match and NAT overload rule, translation does not occur for user traffic.

Answer

No DHCP pool on the outside interface

Answer

No CDP enabled on the router

Answer

No syslog server configured

Question 14

Exhibit: A collector is receiving traffic metadata from a router, including source IP, destination IP, protocol, and byte counts. Which feature is being used?

Accepted Answer

NetFlow. NetFlow exports flow records that summarize traffic conversations. It does not carry full packet payloads, but it does provide useful metadata for analysis and capacity planning.

Answer

Syslog

Answer

SNMP trap

Answer

NTP

Question 15

A user types www.example.com into a browser. Which service is used first to resolve that name into an IP address?

Accepted Answer

DNS. DNS maps hostnames to IP addresses, which is the first step when a user enters a URL. DHCP assigns IP addresses, NTP synchronizes time, and Syslog handles logging—none of these services resolve domain names to IP addresses. The web session itself uses HTTP or HTTPS later, but name resolution happens first.

Answer

DHCP

Answer

NTP

Answer

Syslog